Find exposed credentials. Test access to private data. Get the evidence and a fix prompt for your builder.
See how it worksReads public pages and scripts. Your app stays unchanged.
Start with a public URL
Paste your public HTTPS app URL. The first check reads public pages and scripts; it does not need access to your customer accounts.
DNS record or verification file
Verify control of your domain with a DNS record or verification file. Active tests stay locked until ownership is verified.
Pages, scripts & scoped test pages
Review the pages and scripts a23y can reach. With permission, add exact test-account pages. This is a bounded map, not a complete browser crawl.
Dedicated test accounts and records
Supply dedicated test users and synthetic records. a23y checks the saved read-access boundaries without changing records or creating charges.
Evidence and affected resources
Open a finding to see the redacted request, the observed result and the affected test boundary. Public configuration observations are labelled separately.
Builder prompts & ongoing checks
Copy a fix prompt into your AI builder, review the change, then run the same check again. Enable supported deploy and scheduled checks from your workspace.
FOR APPS BUILT WITH
The affected resource, the evidence, and a prompt to help your builder fix it. Secret values stay redacted.
Anyone who opens the app can read it. Move the credential to the server and replace the exposed key.
Review the change in your builder, deploy it, then run the same check again.
Check your app ↗Illustration of a finding. Actual results come from your app’s public responses.
A public page can look fine while a private record is open. Bring dedicated test accounts to check who can read what.
Sign in, then add a DNS record or ownership file. Active checks stay locked until ownership is verified.
Supply synthetic records and test-user tokens. Check anonymous and cross-account reads, with optional admin-only and paid-only fixtures. No customer records or financial transactions.
Use the builder fix prompt, recheck the same scope, and review what changed. Configure deploy checks, daily outside monitoring or account rechecks every 30 days. Export a coverage report for your client or team.
Scoped read-only checks, including synthetic Supabase records. Broader database audits, injection and checkout testing are still in development.
Free checks are available. Paid plans are in development.
Check public pages and scripts.
€0per appTest access with dedicated accounts.
€49/ month / appRun scheduled and deployment checks.
€99/ month / appManage client apps and team access.
€249/ month · 10 appsOne-off audit · proposed €299 per app, including a single test and trust report.